Wildcards

You can use the asterisk ( * ) character as a wildcard to match an unlimited number of characters in a string. For example,
"my*" matches myhost1 and myhost.ny.mydomain.com.

Be efficient

If you specify an asterisk with no other criteria, you are asking to match everything. Yes, everything. All events are retrieved, up to the maximum limit. A search to match everything is both inefficient and time consuming. You'll use a lot of system resources, which can prevent others from running their searches. Additionally, you might wait a long time for your search results.

To avoid these problems, be as specific as you can in your search criteria.

Be specific

The more specific your search terms are, the more efficient your search is. Sometimes that means not using a wildcard. Searching for a specific word or phrase is more efficient than a search that uses a wildcard. For example, searching for "access denied" is always better than searching for "access*".

Best practices for using wildcards

The best way to use a wildcard is at the end of a term, such as "fail*".

Specify a field-value pair whenever possible to avoid searching the raw field, which is the entire event. For example: status="fail*".

When to avoid wildcard characters

There are several situations in which you should avoid using wildcard characters.

Avoid using wildcards in the middle of a string

Wildcard characters in the middle of a word or string might cause inconsistent results. This is especially true if the string contains punctuation, such as an underscore _ or dash - character.

You create a search that looks for all of the product IDs that begin with the letter S and end in G01.

productID="S*G01"

That search will fail.

When the events with the product IDs are indexed, the product IDs are broken up into segments. For example, the product ID SC-MG-G01 has these segments: SC, MG, G01. There is no segment that starts with an S and ends with G01 which is what the search productID="S*G01" specifies. Because there are no segments that match your search, no results are found.

A search that uses a wildcard in the middle of the term returns inconsistent results because of the way in which data that contains punctuation is indexed and searched.

You want to match every uri_path that starts with /cart. The problem is that the paths contain a forward slash ( / ) character and period ( . ) character. Instead of specifying a wildcard character for the punctuation such as /cart*, specify the punctuation directly in your search criteria. For example,

...uri_path="/cart.do" OR uri_path="/cart/error.do" OR uri_path="/cart/success.do"

.

Avoid using wildcards as prefixes

When you use a wildcard character at the beginning of a string, the search must look at every string to determine if the end of the string matches what you specify after the asterisk. Using a prefix wildcard is almost like using a wildcard by itself. Prefix wildcards might cause performance issues.

Avoid using wildcards at the beginning of search terms.

Other supported wildcards

The LIKE function supports using other wildcards for pattern matching. The percent ( % ) symbol is used as a wildcard for matching multiple characters. The underscore ( _ ) character is used to match a single character.

These wildcards are only applicable to the LIKE function. See like (TEXT, PATTERN) in the list of Comparison and Conditional functions.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »